mailing list archives
Re: CVE request: Digest::SHA double free when using load subroutine
From: Mark Shelor <mshelor () cpan org>
Date: Thu, 17 Jan 2013 09:13:38 +0000 (UTC)
Kurt Seifried <kseifried () > writes:
On 01/15/2013 12:37 PM, Florian Weimer wrote:
* Kurt Seifried:
I'm not clear, how would an attacker exploit this? They'd need to
be able to specify the file that gets hashed, and the file would
have to be not present and would thus trigger the crash? Are
there any real world examples of an affected application? (web
My hunch is that this is just a bug, not a security issue.
I'll leave it for now, if anyone comes up with a security impact/etc.
let us know! (I bet this never happens, ah well =).
Digest::SHA is part of the Perl core, so there's a similarity between this case
and CVE-2008-1927: double-free vulnerability in Perl 5.8.8 allowing a DoS
(memory corruption and crash).
Currently I see no way for an attacker to exploit this bug to allow arbitrary
execution of code from user space. Any vulnerability of that type would appear
to require preexisting vulnerabilities in the Perl/glibc memory allocators.
Regards, Mark (Digest::SHA upstream)